You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Move SAML config into separate page and add multi-SAML (#32469)
* Move SAML config into separate page and add multi-SAML
* Fix menu
* Fix menu but for real
* Apply suggestions from code review
Co-authored-by: Bryce Eadie <bryce.eadie@datadoghq.com>
* Add considerations + restyle notes
* Rewording
* Incorporate considerations into procedure
* Update link and remove a sentence
* Apply suggestions from code review
Co-authored-by: Bryce Eadie <bryce.eadie@datadoghq.com>
* Apply suggestions from code review
Co-authored-by: Bryce Eadie <bryce.eadie@datadoghq.com>
* NoPassword->LastPass, and link to role mapping doc
* Swap screenshot and rewrite single SAML config procedure
* Remove unnecessary step and add team mapping info
---------
Co-authored-by: Bryce Eadie <bryce.eadie@datadoghq.com>
Copy file name to clipboardExpand all lines: content/en/account_management/saml/_index.md
+11-51Lines changed: 11 additions & 51 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,38 +28,15 @@ Configuring [SAML (Security Assertion Markup Language)][1] for your Datadog acco
28
28
29
29
## Configuring SAML
30
30
31
-
1. To begin configuration, see your IdP's documentation:
32
-
33
-
*[Active Directory][10]
34
-
*[Auth0][11]
35
-
*[Google][13]
36
-
*[Microsoft Entra ID][12]
37
-
*[NoPassword][14]
38
-
*[Okta][15]
39
-
*[SafeNet][16]
40
-
41
-
2. In the Datadog app, hover over your username in the bottom left corner and select Organization Settings. Select [Login Methods][17] and click on **Configure** under SAML.
42
-
43
-
3. Upload the IdP metadata from your SAML identity provider by clicking the **Choose File** button. After choosing the file, click **Upload File**.
44
-
45
-
**Note:** The IdP metadata must contain ASCII characters only.
46
-
47
-
4. Download Datadog's [Service Provider metadata][18] to configure your IdP to recognize Datadog as a Service Provider.
48
-
49
-
5. After you upload the IdP metadata and configure your IdP, enable SAML in Datadog by clicking the **Upload and Enable** button.
50
-
{{< img src="account_management/saml/saml_enable_cropped.png" alt="Configure SAML by uploading your IdP metadata" >}}
51
-
52
-
6. After uploading the IdP metadata, return to the **Login Methods** page and turn SAML `on` by default.
53
-
54
-
**Note**: To configure SAML for a multi-org, see [Managing Multiple-Organization Accounts][21].
31
+
See [Configuring Single Sign-On With SAML][2] for instructions.
55
32
56
33
## Using SAML
57
34
58
35
After SAML is configured in Datadog and your IdP is set up to accept requests from Datadog, users can log in.
59
36
60
37
### SP-initiated login
61
38
62
-
SP-initiated, or Service Provider-initiated, means login initiated from Datadog. Users log in through the **Single Sign-on URL** shown in the status box at the top of the [SAML Configuration page][19]. The **Single Sign-on URL** is also displayed on the [Team page][20]. Loading this URL initiates a SAML authentication against your IdP. **Note**: This URL only displays if SAML is enabled for your account and you are using SP-initiated login.
39
+
SP-initiated, or Service Provider-initiated, means login initiated from Datadog. Users log in through the **Single Sign-on URL** shown in the status box at the top of the [SAML Configuration page][4]. Loading this URL initiates a SAML authentication against your IdP. **Note**: This URL only displays if SAML is enabled for your account and you are using SP-initiated login.
63
40
64
41
{{< img src="account_management/saml/saml_enabled_cropped.png" alt="Confirmation that SAML Enabled" >}}
65
42
@@ -83,7 +60,7 @@ When a login occurs, a SAML Assertion containing user authorization is sent from
83
60
84
61
* Assertions must be signed.
85
62
* Assertions can be encrypted, but unencrypted assertions are accepted.
86
-
* Reference [Datadog's Service Provider metadata][18] for more information. You must be signed in to Datadog to access the file.
63
+
* Reference [Datadog's Service Provider metadata][3] for more information. You must be signed in to Datadog to access the file.
87
64
88
65
### Supported attributes
89
66
@@ -115,9 +92,9 @@ If **sn** and **givenName** are provided, they are used to update the user's nam
115
92
116
93
## Additional features
117
94
118
-
To map attributes in your identity provider's response to Datadog roles and teams, see [SAML group mapping][22].
95
+
To map attributes in your identity provider's response to Datadog roles and teams, see [SAML group mapping][5].
119
96
120
-
The following features can be enabled through the [SAML Configuration dialog][19]:
97
+
The following features can be enabled through the [SAML Configuration dialog][4]:
121
98
122
99
**Note:** You must have Admin permissions to see the SAML Configuration dialog.
123
100
@@ -145,7 +122,7 @@ If you do not use the updated SP metadata, Datadog is not able to associate the
145
122
146
123
### SAML strict
147
124
148
-
You can make your organization SAML Strict by disabling other login method types in the **Login Methods** UI. When this option is configured, all users must, by default, log in with SAML. An existing username/password or Google OAuth login does not work. This ensures that all users with access to Datadog must have valid credentials in your company's identity provider/directory service to access your Datadog account. Org administrators can set per-user [overrides][23] to allow certain users to be SAML Strict exempt.
125
+
You can make your organization SAML Strict by disabling other login method types in the **Login Methods** UI. When this option is configured, all users must, by default, log in with SAML. An existing username and password, or Google OAuth login, does not work. This ensures that all users with access to Datadog must have valid credentials in your company's identity provider or directory service to access your Datadog account. Org administrators can set per-user [overrides][6] to allow certain users to be SAML Strict exempt.
149
126
150
127
### Self-updating Datadog SP metadata
151
128
@@ -158,25 +135,8 @@ Certain Identity Providers (such as Microsoft's ADFS) can be configured to pull
description: Configure SAML authentication for Datadog with identity providers like Active Directory, Auth0, Google, Okta, and Microsoft Entra ID for secure single sign-on.
4
+
disable_toc: false
5
+
further_reading:
6
+
- link: "/account_management/saml/"
7
+
tag: "Documentation"
8
+
text: "Single Sign-On With SAML"
9
+
- link: "account_management/saml/mapping/"
10
+
tag: "Documentation"
11
+
text: "SAML Group Mapping"
12
+
algolia:
13
+
tags: ['saml']
14
+
---
15
+
16
+
## Overview
17
+
18
+
This page covers how to enable single sign-on (SSO) with SAML in Datadog, as well as how enterprise customers can enable multiple SAML identity providers (IdPs).
- If you don't have SAML enabled on your Datadog account, reach out to [support][1] to enable it.
24
+
- This documentation assumes that you already have a SAML Identity Provider (IdP). If you do not have a SAML IdP, there are several IdPs that have integrations with Datadog such as [Active Directory][9], [Auth0][3], [Google][4], [LastPass][5], [Microsoft Entra ID][2], [Okta][6], and [SafeNet][7].
25
+
- SAML configuration requires [Datadog Administrator][8] access, or the `Org Management` permission if you're using custom roles.
26
+
{{% /site-region %}}
27
+
28
+
{{% site-region region="gov" %}}
29
+
- This documentation assumes that you already have a SAML Identity Provider (IdP). If you do not have a SAML IdP, there are several IdPs that have integrations with Datadog such as [Active Directory][9], [Auth0][3], [Google][4], [LastPass][5], [Microsoft Entra ID][2], [Okta][6], and [SafeNet][7].
30
+
- SAML configuration requires [Datadog Administrator][8] access, or the `Org Management` permission if you're using custom roles.
31
+
{{% /site-region %}}
32
+
33
+
## Configuring SAML
34
+
35
+
1. To begin configuration, see your IdP's documentation:
36
+
37
+
*[Active Directory][9]
38
+
*[Auth0][10]
39
+
*[Google][12]
40
+
*[Microsoft Entra ID][11]
41
+
*[LastPass][13]
42
+
*[Okta][14]
43
+
*[SafeNet][15]
44
+
45
+
2. Download Datadog's [Service Provider metadata][17] to configure your IdP to recognize Datadog as a Service Provider.
46
+
47
+
3. In Datadog, hover over your username in the bottom left corner and select **Organization Settings**. Select [**Login Methods**][16] and click **Configure** under SAML.
48
+
49
+
4. Click **Add SAML**.
50
+
51
+
5. In the configuration modal:
52
+
* Create a user-friendly name for this SAML provider. The name appears to end users when they choose a login method.
53
+
* Upload the IdP metadata from your SAML identity provider by clicking **browse files** or dragging and dropping the XML metadata file onto the modal.
54
+
<br>
55
+
<divclass="alert alert-info">The IdP metadata must contain ASCII characters only.</a></div>
56
+
57
+
{{< img src="account_management/saml/saml_configure.png" alt="Configure SAML by uploading your IdP metadata" style="width:100%;" >}}
58
+
59
+
6. Click **Save**.
60
+
61
+
**Note**: To configure SAML for a multi-org, see [Managing Multiple-Organization Accounts][18].
62
+
63
+
## Configuring multiple SAML providers
64
+
65
+
Enterprise customers can have multiple SAML configurations per organization (up to three at the same time). This feature simplifies identity management across complex environments, such as during IdP changes, mergers, or contractor onboarding.
66
+
67
+
To configure additional SAML providers:
68
+
69
+
1. Navigate to **Organization Settings > Login Methods**. Under **SAML**, click **Update**, then **Add SAML**.
70
+
2. In the configuration modal:
71
+
72
+
- Create a user-friendly name for this SAML provider. The name appears to end users when they choose a login method.
73
+
<br>
74
+
<divclass="alert alert-info">All users can see and access all configured IdPs; there is no way to assign specific user groups to specific configurations. Setting clear and descriptive names for each provider helps users select the appropriate IdP during login. Also note that there is no way to set a default configuration.</a></div>
75
+
- Upload the IdP metadata from your SAML identity provider by clicking **browse files** or dragging and dropping the XML metadata file onto the modal.
76
+
4. Click **Save**.
77
+
78
+
### Role mapping with multiple SAML providers
79
+
80
+
If you use SAML [role mapping][19] or [team mapping][20] and want to use the same mappings in any additional providers you add, make sure the attributes in the new IdP(s) match what is defined in your mappings. If you add a new IdP, make sure to either use the same attribute names as your existing IdP, or add new mappings that align with the new IdP's attributes to ensure roles and teams are assigned correctly when users log in with different IdPs.
0 commit comments